[34] M. Johnson. fix prng key reuse in differential privacy example. https://github.com/google/jax/pull/3646, 2020.
[35] P. Kairouz, S. Oh, and P. Viswanath. The composition theorem for differential privacy. In International conference on machine learning, pages 1376-1385. PMLR, 2015.
[36] D. Kifer and A. Machanavajjhala. Pufferfish: A framework for mathematical privacy definitions. ACM Transactions on Database Systems (TODS), 39(1):1-36, 2014.
[37] T. Kutta, Ö. Askin, and M. Dunsche. Lower Bounds for Rényi Differential Privacy in a Black-Box Setting. arXiv preprint arXiv:2212.04739, 2022.
[38] X. Liu and S. Oh. Minimax Optimal Estimation of Approximate Differential Privacy on Neighboring Databases. In Advances in Neural Information Processing Systems, volume 32, 2019.
[39] F. Lu, J. Munoz, M. Fuchs, T. LeBlond, E. Zaresky-Williams, E. Raff, F. Ferraro, and B. Testa. A General Framework for Auditing Differentially Private Machine Learning. In NeurIPS, 2022.
[40] M. Lyu, D. Su, and N. Li. Understanding the sparse vector technique for differential privacy. arXiv preprint arXiv:1603.01699, 2016.
[41] S. Maddock, A. Sablayrolles, and P. Stock. CANIFE: Crafting canaries for empirical privacy measurement in federated learning. In ICLR, 2023.
[42] M. Malek Esmaeili, I. Mironov, K. Prasad, I. Shilov, and F. Tramer. Antipodes of label differential privacy: Pate and alibi. Advances in Neural Information Processing Systems, 34: 6934-6945, 2021.
[43] F. D. McSherry. Privacy integrated queries: an extensible platform for privacy-preserving data analysis. In Proceedings of the 2009 ACM SIGMOD International Conference on Management of data, pages 19-30. ACM, 2009.
[44] I. Mironov. Rényi Differential Privacy. In 30th IEEE Computer Security Foundations Symposium, CSF 2017, Santa Barbara, CA, USA, August 21-25, 2017, pages 263-275. IEEE Computer Society, 2017.
[45] M. Nasr, S. Songi, A. Thakurta, N. Papernot, and N. Carlini. Adversary Instantiation: Lower Bounds for Differentially Private Machine Learning. In 2021 IEEE Symposium on Security and Privacy (SP), pages 866-882. IEEE, 2021.
[46] M. Nasr, J. Hayes, T. Steinke, B. Balle, F. Tramér, M. Jagielski, N. Carlini, and A. Terzis. Tight Auditing of Differentially Private Machine Learning. arXiv preprint arXiv:2302.07956, 2023.
[47] M. Park. Bug-fix. https://github.com/mijungi/vips_code/commit/4e32042b66c960af618722a43c32f3f2dda2730c, 2018.
[48] N. Ponomareva, H. Hazimeh, A. Kurakin, Z. Xu, C. Denison, H. B. McMahan, S. Vassilitskii, S. Chien, and A. Thakurta. How to DP-fy ML: A Practical Guide to Machine Learning with Differential Privacy. arXiv Preprint, 2023.
[49] M. A. Rahman, T. Rahman, R. Laganière, N. Mohammed, and Y. Wang. Membership Inference Attack against Differentially Private Deep Learning Model. Trans. Data Priv., 11(1):61-79, 2018.
[50] J. Reed and B. C. Pierce. Distance makes the types grow stronger: a calculus for differential privacy. In ACM Sigplan Notices, volume 45, pages 157-168. ACM, 2010.
[51] I. Roy, S. T. Setty, A. Kilzer, V. Shmatikov, and E. Witchel. Airavat: Security and privacy for MapReduce. In *NSDI*, volume 10, pages 297–312, 2010.
[52] S. Sankararaman, G. Obozinski, M. I. Jordan, and E. Halperin. Genomic privacy and limits of individual detection in a pool. Nature genetics, 41(9):965-967, 2009.